1. Field of the Invention
The present invention relates generally to an apparatus and method for the management of a network, and more particularly to a network management apparatus capable of determining the topology of a network and method for such an apparatus.
2. Description of the Related Art
The following description is concerned with a data communications network, and in particular a local area network (LAN) but has more widespread applicability to other managed communications systems including wide area networks (WANs) or wireless communications systems.
Networks typically comprise a plurality of computers, peripherals and other electronic devices capable of communicating with each other by sending and receiving data packets in accordance with a predefined network protocol. Each computer or other device on the network is connected by a port to the network media, which in the case of a LAN network may be coaxial cable, twisted pair cable or fibre optic cable. Each device on the network typically has hardware for media access control (MAC) with its own unique MAC address. Data packets are sent and received in accordance with the MAC protocol (e.g. CSMA/CD protocol as defined by the standard IEEE 802.2, commonly known as Ethernet). Data packets transmitted using the MAC protocol identify the source MAC address (i.e. the MAC address of the device sending the data packet) and the destination MAC address (i.e. the MAC address of the device for which the data packet is destined) in the header of the data packet.
A network is generally configured with core devices having a plurality of ports, which can be used to interconnect a plurality of media links on the network. Such devices include hubs, repeaters, routers and switches which pass data packets received at one port to one or more of its other ports, depending upon the type of device. Such core devices can either be managed or unmanaged.
A managed device is capable of monitoring data packets passing through its ports. For example, a managed device can learn the physical or MAC addresses of the devices connected to its ports by monitoring the source address of data packets passing through the respective ports. Identified source addresses transmitted from a port of a managed network device, such as a router, hub, repeater or switch, are stored in a respective “address table” associated with the port, as described further below.
Managed devices additionally have the capability of communicating with each other using a management protocol such as the Simple Network Management Protocol (SNMP), as described in more detail below. Whilst the following description is concerned with the SNMP management protocol the skilled person will appreciate that the invention is not limited to use with SNMP, but can be applied to managed networks using other network management protocols.
SNMP defines agents, managers and MIBs (where MIB is Management Information Base), as well as various predefined messages and commands for data communication. An agent is present in each managed network device and stores management data, responds to requests from the manager using the GETRESPONSE message and may send a TRAP message to the manager after sensing a predefined condition. A manager is present within the network management station of a network and automatically interrogates the agents of managed devices on the network using various SNMP commands such as GET and GETNEXT commands, to obtain information suitable for use by the network administrator, whose function is described below. A MIB is a managed “object” database which stores management data obtained by managed devices, accessible to agents for network management applications.
SNMP, along with the standard IEEE 802.2 (Ethernet) protocol, forms part of the TCP/IP protocol suite, which is a number of associated protocols developed for networks connected to the Internet.
It is becoming increasingly common for an individual, called the network administrator, to be responsible for network management, and his or her computer system or workstation is typically designated the network management station. The network management station incorporates the manager, as defined in the SNMP protocol, i.e. the necessary hardware, and software applications to retrieve data from MIBs by sending standard SNMP requests to the agents of managed devices on the network.
Network management software applications are known which can determine the topology of a network, i.e. the devices on the network and how they are linked together. In order to determine the network topology, the application retrieves data from the managed devices on the network, which data can provide information about the devices connected to the managed devices, for instance the aforementioned “address tables”. MIB data retrieved from managed devices can also provide information about device type, device addresses and details about the links. Using such data, the application can usually determine the topology of the entire network.
An example of a known network management software application capable of determining network topology is the Transcend® Network Supervisor application available from 3Com Corporation of Santa Clara, Calif., USA.
A part of the network administrator's function is to identify and resolve problems occurring on the network, such as device or link malfunction or failure. In order to provide the network administrator with the necessary information to identify such problems, the network management software application continually monitors the devices on the network. For example, it periodically retrieves from managed network devices selected MIB data indicative of device and link operation, and at periodic intervals performs tests for device activity and service availability. Such tests may include sending ICMP Ping requests to every known device on the network, or sending selected requests for services such as SMTP, NFS and DNS to servers, and monitoring the time taken to receive a response.
The network management application compares the retrieved data and test results against corresponding threshold levels, above which performance is considered to be unacceptable. Such thresholds may be preset by the application vendor, or may be set by the network administrator. Each time a threshold is exceeded, the application logs an “Event”. The “Event log” lists each Event, including information such as the date and time of the Event, the identity of the device affected and the nature of the Event. The network administrator can then review the Event list to identify problems on the network.
A problem with this way of identifying problems on the network is that if a core network device, or a trunk link, fails, it will cause a large number of Events to be logged on the Event log. This large number of Events results because the network management station does not receive responses to data requests or tests from devices which are “downstream” from the failed device or link relative to the management system. Thus, an Event will be logged each time the network management station fails to receive a response from such devices. This “flooding” of Events makes it difficult for the network administrator to determine whether there are a number of unrelated problems occurring on the network, or there is a single root cause for the “avalanche” of Events and if so, where the cause lies.
It would be desirable to provide a network management apparatus and method which overcomes this problem.